What is the difference between NFC and Bluetooth BLE for access control?

NFC (ISO/IEC 14443, 13.56 MHz) operates at ranges up to 10cm and requires the phone to be held close to the reader — similar to a contactless card tap. Bluetooth BLE (5.x) operates at ranges up to 5 metres and enables hands-free Twist and Go access where the user's credential is presented automatically as they approach the reader with a wrist rotation gesture, without touching the reader or unlocking the phone. NFC is faster per transaction (sub-100ms) and works even when the phone battery is critically low. BLE enables hands-free operation ideal for hands-full scenarios (carrying boxes, pushing doors). Most enterprise deployments specify readers that support both protocols simultaneously.

Can mobile credentials completely replace physical access cards?

Yes — in full mobile-first deployments, physical cards are eliminated entirely. HID Mobile Access and ASSA ABLOY Seos support credential issuance via email invitation, no physical card required. Multi-device support ensures users can have credentials on smartphone, smartwatch, and tablet simultaneously. The remaining consideration is visitor and contractor access — most enterprises maintain a small stock of temporary physical cards or visitor QR codes for non-employees who cannot install the mobile credential app. For 95%+ of regular employees, smartphones running Android 6.0+ or iOS 13+ support all major mobile credential platforms without any hardware modification.

What happens when the user's phone battery dies — does mobile access stop working?

For NFC-based mobile credentials, Apple iPhone 13+ and newer Samsung Galaxy devices support Power Reserve NFC — the credential remains available via NFC for several hours even when the phone battery is completely depleted, using residual capacitor energy in the NFC antenna circuit. For BLE Twist and Go credentials, power reserve is not available and the credential requires the phone to be powered on. HID Mobile Access handles this with Express Mode on iPhones — the credential is available without Face ID/Touch ID authentication and with minimal battery, similar to transit card express mode. For mission-critical sites, ASDV recommends maintaining a small pool of emergency temporary cards as a fallback for battery-dead scenarios.

How are mobile credentials revoked instantly when an employee leaves?

Mobile credentials on platforms like HID Origo and ASSA ABLOY Seos are revoked from the cloud management console in under 30 seconds — the credential is marked invalid in the cloud, and the next time the device checks in (typically within minutes for connected phones), the credential is deleted from the secure element. For immediate revocation, the cloud platform pushes a silent push notification to the credential app triggering an immediate check-in and deletion. This is significantly faster and more reliable than physical card revocation, which requires the card to be physically collected — a process that often fails when terminated employees retain their cards.

Which access control panels are compatible with HID Mobile Access?

HID Mobile Access is compatible with any access control panel that supports readers communicating via Wiegand 26/34-bit or OSDP v2 — which includes virtually all enterprise PACS including Lenel OnGuard, Genetec Synergis, Honeywell Pro-Watch, Software House C•CURE 9000, Bosch Access Management System, and Siemens SiPass. The mobile credential is presented to an HID Signo or iCLASS SE reader, which translates the mobile credential to a Wiegand or OSDP reader output to the access panel — no panel replacement is required. HID Signo readers support OSDP v2 AES-128 encrypted communication for highest security.

Is the Twist and Go Bluetooth feature available without upgrading readers?

Twist and Go requires BLE-capable readers — existing Wiegand-only or RFID-only readers do not support BLE and must be replaced with BLE-enabled models (HID Signo BLE, ASSA ABLOY Aperio BLE, Allegion Schlage BLE series). The reader replacement is the primary cost of Twist and Go deployment, since access panels typically do not require replacement (the reader presents a standard Wiegand or OSDP credential to the panel regardless of whether it came from a card or BLE mobile credential). Reader upgrades at a typical 100-door enterprise installation are completed within 1–2 days of installation work.

Can one mobile credential work across multiple buildings and sites?

Yes — multi-site mobile credential management is a core enterprise feature. HID Origo cloud portal and ASSA ABLOY Seos mobile platform both support issuing a single mobile credential to a user that is valid across all sites configured in the tenant. The access policy (which zones and times are permitted at each site) is controlled centrally and pushed to each site's access control infrastructure. When the user presents their mobile credential at a different city or country office, the credential is validated against the local access policy — no separate card or credential app is needed per site. This is a major operational advantage over physical cards, which typically need to be re-issued or added per site.

Are mobile credentials compliant with ISO 27001 and India's DPDP Act 2023?

Mobile credential platforms from HID Global, ASSA ABLOY, and Allegion are certified to ISO 27001 for their cloud management infrastructure. The credential itself uses AES-256 encryption with mutual authentication, meeting or exceeding ISO 27001 Annex A.11 physical access control requirements. Under India's DPDP Act 2023, mobile credential issuance involves collection of the user's device identifier and credential usage logs — classified as personal data. The organisation must have a privacy notice, obtain consent for credential issuance, retain logs only for the defined retention period, and provide data deletion on request. ASDV Consultant designs mobile credential deployments with DPDP-compliant data flows and privacy architecture from the outset.

What encryption does ASSA ABLOY Seos use for mobile credentials?

ASSA ABLOY Seos uses AES-256 symmetric encryption for the credential data stored in the phone's secure element (Trusted Execution Environment on Android, Secure Enclave on iOS), combined with a proprietary mutual authentication protocol between the mobile device and the Seos-compatible reader. The communication channel between phone and reader uses a session key derived from Elliptic Curve Diffie-Hellman (ECDH) key agreement, ensuring each transaction uses a unique session key that cannot be replayed. This prevents the man-in-the-middle and relay attacks that have been demonstrated against older 125kHz proximity card systems.

What is Apple Wallet HomeKey and how does it work for access control?

Apple Wallet HomeKey is Apple's native NFC and UWB (Ultra-Wideband) credential standard for access control, integrated directly into iOS 15+ Wallet app without requiring a separate credential vendor app. HomeKey uses the W3C WebAuthn-derived attestation protocol and Matter (formerly CHIP) protocol for reader communication. HomeKey credentials are issued via a link or email by the access control system operator and stored in the iPhone/Apple Watch Wallet. HomeKey with UWB provides highly accurate proximity detection (sub-30cm), enabling hands-free access without the false activations that can affect longer-range BLE systems. ASSA ABLOY, Allegion, and Dormakaba have announced HomeKey-compatible reader products. HomeKey is not yet available for Android — Google Wallet Pass provides a similar but separate credential ecosystem.

How does mobile access control prevent credential sharing?

Mobile credentials are bound to a specific device's secure hardware element — the Trusted Execution Environment (Android) or Secure Enclave (iOS). The credential cannot be copied, exported, or transferred to another device. If a user attempts to install the credential app on a second device, a new credential issuance request is generated that requires administrator approval — the original credential is not cloned. This is fundamentally different from physical proximity cards (125kHz EM4100, HID Prox), which can be cloned in under 5 seconds with a £30 handheld reader/writer, or even MIFARE Classic cards which have well-documented cryptographic weaknesses. Mobile credentials bound to the device secure element are currently the most cloning-resistant credential technology available for enterprise access control.

What is OSDP v2 and why is it important for mobile credential deployments?

OSDP (Open Supervised Device Protocol) v2 is an IEC 60839-11-5 standard communication protocol between access control readers and access control panels — replacing the legacy Wiegand one-way protocol with a bi-directional, encrypted channel. OSDP v2 supports AES-128 encryption between reader and panel, preventing the eavesdropping attacks possible on unencrypted Wiegand. It also provides tamper detection, reader health monitoring, and LED/buzzer control from the panel. For mobile credential deployments, OSDP v2 ensures the security of the entire credential path: AES-256 in the phone's secure element → BLE/NFC to reader → AES-128 OSDP to panel — creating an end-to-end encrypted chain from credential to access decision. ASDV specifies OSDP v2 as the reader-to-panel protocol for all new access control installations.

Mobile Credentials NFC & Bluetooth BLE: HID Mobile Access, ASSA ABLOY Seos & Hands-Free Access

The 125kHz proximity card — unchanged in fundamental technology since the 1990s — can be cloned in under five seconds with a device that costs less than ₹2,500. MIFARE Classic cards, deployed across millions of doors in Indian corporate offices and residential complexes, carry documented cryptographic vulnerabilities that were published in 2008 and have never been patched. The physical access card as the primary enterprise credential is a security anachronism.

Mobile credentials on NFC and BLE change the threat model entirely. The credential lives in the phone's Secure Enclave or Trusted Execution Environment — hardware-isolated from the operating system, encrypted with AES-256, and bound to the specific device's hardware root of trust. It cannot be copied, exported, photographed, or cloned. It can be revoked from the cloud in under 30 seconds, from anywhere, the moment an employee leaves the organisation. And with Bluetooth BLE Twist and Go, it presents itself automatically as the user approaches the reader — without touching the reader, unlocking the phone, or removing anything from a pocket.

Mobile credential adoption in enterprise access control grew 340% between 2020–2025, with 68% of new enterprise access control deployments in 2025 specifying mobile-only or mobile-first credential strategies. HID Global State of Physical Security Report, 2025.

Mobile Credential Platform Comparison

Platform	Protocol	Reader Compatibility	Twist & Go / Hands-Free	Multi-Device	India Available
HID Mobile Access (Origo)	NFC + BLE 5.x	HID Signo, iCLASS SE	Yes — BLE Twist and Go	Yes (phone + watch)	Yes (HID India)
ASSA ABLOY Seos	NFC + BLE	ABLOY Aperio, CLIQ	Yes — BLE Hands-Free	Yes	Yes (distributor)
Allegion Engage	BLE + NFC	Schlage BLE readers	Yes — BLE Auto-unlock	Yes	Limited
Apple Wallet HomeKey	NFC + UWB	ASSA ABLOY, Allegion, Dormakaba	Yes — UWB Precision	iPhone + Apple Watch	iOS 15+
Samsung Wallet Pass	NFC + BLE	Partner readers	Limited	Phone + Watch	Galaxy S21+
Google Wallet Pass	NFC	NFC readers (standard)	No hands-free	Android 6.0+	Yes (Android)

Technical Design: Mobile Credential Architecture

NFC protocol (ISO/IEC 14443 Type A/B, 13.56 MHz): Operates at up to 10cm range; requires phone near reader; works even with critically low battery on iPhone (Power Reserve NFC); sub-100ms transaction time — identical user gesture to contactless card
BLE Twist and Go: Wrist rotation gesture detected by phone accelerometer triggers credential broadcast at 3–5m range; user approaches reader, door unlocks before they reach it — no phone interaction required; ideal for hands-full scenarios
ASSA ABLOY Seos encryption: AES-256 credential storage in Secure Enclave/TEE; ECDH session key per transaction — prevents relay and replay attacks that defeated earlier BLE access systems
HID Origo cloud platform: Credential provisioning via email invitation; revocation <30 seconds; REST API for HR system integration (Workday, SAP); audit log export for ISO 27001 evidence
Apple Wallet HomeKey (Matter protocol): iOS 15+ native — no separate vendor app; UWB precise ranging (sub-30cm) for hands-free; credential stored in Secure Enclave; works offline at reader
OSDP v2 reader-to-panel: HID Signo readers use IEC 60839-11-5 OSDP v2 with AES-128 — encrypted from mobile credential in phone through to access panel; replaces insecure Wiegand for new installations
India compatibility: Android 6.0+ (NFC + BLE) and iOS 13+ (NFC + BLE) — covers 95%+ of active enterprise smartphones in India; no MDM enrollment required for credential app installation

Future Outlook: 2028–2032

Passive UWB Credentials: No App, No Tap, No Gesture

Ultra-Wideband (UWB) chip integration in all premium smartphones enables centimetre-accurate indoor positioning that will drive the next generation of access control: completely passive access where the building recognises the authorised person as they walk through a corridor and unlocks the door ahead of them — no tap, no twist, no gesture, no interaction. Combined with continuous ambient authentication (gait + phone position), the single-event door credential will be replaced by a continuous presence-based access model where physical space responds to identity rather than identity responding to physical space.

Frequently Asked Questions

NFC operates at up to 10cm and requires the phone near the reader — fast (sub-100ms), works with low battery, similar gesture to card tap. BLE operates at up to 5 metres and enables Twist and Go hands-free access — the credential presents automatically on a wrist rotation gesture without touching the reader or unlocking the phone. Enterprise readers like HID Signo support both simultaneously, giving users the choice of tap or hands-free depending on scenario.

iPhone 13+ and newer Samsung Galaxy devices support Power Reserve NFC — the credential remains available via NFC for several hours even after the phone is fully depleted. BLE Twist and Go requires power and is unavailable when the battery is dead. For mission-critical sites, ASDV recommends maintaining a small stock of emergency temporary cards as a battery-dead fallback. HID Express Mode on iOS enables credential use without Face ID authentication and with minimal remaining battery.

Revocation from HID Origo or ASSA ABLOY Seos cloud console marks the credential invalid in under 30 seconds. The next credential app check-in (triggered by a silent push notification) deletes the credential from the device secure element. This is fundamentally more reliable than physical card revocation, which requires the employee to hand back the card — a step that frequently fails when employees are terminated.

Mobile Credentials (NFC & Bluetooth BLE): HID Mobile Access, ASSA ABLOY Seos & Hands-Free Twist and Go Enterprise Access Control

Mobile Credential Platform Comparison

Technical Design: Mobile Credential Architecture

Mobile Credential Access Design

Passive UWB Credentials: No App, No Tap, No Gesture

Frequently Asked Questions

Design Your Mobile Credential Access Control System